Fix CachyOS repo detection and preflight GRUB kernel actions

[musqa]

Type of Change

• Bug fix

Description

The CachyOS installer exits before installation on a system with no CachyOS repositories: an unguarded grep assignment returns 1 under the script's /bin/sh -e interpreter. The current regex also misses the base [cachyos] section. Kernel actions assume GRUB and can modify repositories or install packages before failing on systems using Limine or systemd-boot.

This change handles missing, active, and commented repository sections explicitly. Kernel-default actions validate their GRUB prerequisites before repository or kernel operations. It also corrects the default-reset string comparison and regenerates GRUB after a successful edit, propagates download/extraction failures, and restricts cleanup to the downloaded archive and helper directory so it cannot remove cachyos-repos.sh itself.

Regression tests execute the real script through its /bin/sh -e shebang with temporary configuration paths and mocked package, download, privilege, and bootloader commands. A path-filtered CI job runs them.

Validation

• All 14 regression tests pass; the unchanged baseline produces 36 failing cases/subcases with the same harness.
• ShellCheck 0.11.0, checkbashisms, sh -n, and git diff --check pass.
• Reproduced the original repo-check exit using an Omarchy system's pacman.conf with no CachyOS entries. That system uses Limine and has neither /etc/default/grub nor grub-mkconfig.
• No live package installation or bootloader modification was performed. VM boot testing and Rust/TUI build testing were not performed.

Scope

This fixes repository detection and fails early for unsupported kernel-default actions. Repository-only setup remains available independently of GRUB. It does not add Limine kernel selection, change the existing Arch-specific GRUB menu identifier, or add support for repository sections in included pacman configuration files.

Limine integration warrants a separate change with boot testing: CachyOS selected Limine as its default in January 2026 (https://cachyos.org/blog/2601-january-release/).

Issues / other PRs related

• Follow-up to CachyOS Fix #1319; the no-match/errexit failure remains in that version.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

AGENTS.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 10872da6-7138-46f4-b9b3-608a81d7537b

📥 Commits

Reviewing files that changed from the base of the PR and between 0b0f744 and 1541880.

📒 Files selected for processing (3)

• .github/workflows/cachyos-tests.yml
• core/tabs/system-setup/arch/cachyos-repos.sh
• tests/test_cachyos_repos.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • CachyOS repository detection now distinguishes configured sections from unrelated mentions, reducing incorrect installation or removal decisions.
  • Kernel and GRUB changes now check for required repositories and settings before proceeding. Resetting the default preserves other boot choices.
  • Repository downloads and extraction failures now stop setup instead of continuing with incomplete files.
• Tests
  • Added automated regression checks for repository setup, kernel actions, GRUB behavior, and failure handling.
  • Added a workflow to run these checks on relevant pull requests and on demand.

Walkthrough

The CachyOS repository script now distinguishes configured from active repository sections and updates repository, kernel, and GRUB operations. New integration tests exercise these behaviors and command failures. A GitHub Actions workflow runs the tests on relevant pull requests or manual dispatch.

Changes

CachyOS setup

Layer / File(s)	Summary
Repository detection and management core/tabs/system-setup/arch/cachyos-repos.sh, tests/test_cachyos_repos.py	Repository detection distinguishes configured from active CachyOS sections. Installation and removal use explicit download failure handling and cleanup. Tests cover detection, installation, removal, and failure behavior.
Kernel and GRUB operations core/tabs/system-setup/arch/cachyos-repos.sh, tests/test_cachyos_repos.py, .github/workflows/cachyos-tests.yml	Kernel actions now check GRUB prerequisites and active repositories. Reset behavior matches the exact CachyOS LTS setting. Tests cover preflight, kernel actions, reset, and command failures. The workflow runs the test suite on matching pull requests or manual dispatch.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 15418

The change fixes CachyOS repository detection and checks GRUB prerequisites before kernel actions, with regression tests and a CI workflow. No merge-blocking risk is identified from the supplied evidence.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 15418

Earlier prerequisite checks and narrower cleanup reduce risk. One recovery gap remains: after a failed bootloader reset, retrying can report success without regenerating the boot configuration. Exposure remains within locally authorized host-management actions, and live boot and recovery behavior have not been validated.

Retained concerns

• Medium · reliability · inferred: The repaired reset transition writes GRUB_DEFAULT=0 before regenerating grub.cfg. If regeneration fails or execution is interrupted afterward, retrying choice 4 or 5 skips regeneration because the source setting no longer matches CachyOS, and can return success while generated boot state remains unreconciled. This weakens rollback and recovery guarantees; it does not establish an exploitable security vulnerability.

Security review details

Security Blast Radius

• inferred — The sensitive scope is the machine on which an authorized user runs the menu: repository setup, privileged kernel package installation, and boot configuration. Downloaded helper execution carries host-level authority, but its further effects cannot be bounded from the inspected wrapper alone.

Trust Boundaries and Controls

• observed — Production mutations still pass through the existing environment checks and escalation selection: root uses env, otherwise sudo or doas is selected, and super-user-group membership is checked. The PR changes preflight ordering without removing these checks. Vendor-supplied archive content then crosses into elevated helper execution; the wrapper shows no separate artifact-signature verification.
• observed — The test privilege wrapper runs local mocks without elevating privileges, and fixture writes and deletion validate their targets. CI uses pull_request rather than pull_request_target and requests read-only repository contents permission. These controls counter the suggestion that the flagged test entrypoints introduce production host-management authority.

Hardening Proposals

• proposed — Make reset recovery reconcile generated boot state after an interrupted or failed regeneration, rather than treating the edited source setting as proof of completion. Preserve unrelated user-selected defaults while making retries complete the pending reset.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 23 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main changes: fixing CachyOS repository detection and checking GRUB prerequisites before kernel actions.
Description check	✅ Passed	The description explains the repository-detection and GRUB preflight fixes, related failure handling, regression tests, and scope.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 23 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}